﻿using System;
using Ast.Core.Services.Extensions;
using Ast.Framework;
using Ast.Framework.Caching;
using Castle.Core.Logging;

namespace Ast.Core.Services
{
    public interface IKernelAddressFinder : ISingletonDependency
    {
        IntPtr FindKpcr();
        IntPtr FindKdDebuggerData64();
        IntPtr FindIdt();
        IntPtr FindGdt();
        IntPtr FindPsLoadedModuleList();
        IntPtr FindPsActiveProcessHead();
        IntPtr FindPspCidTable();
        IntPtr FindObpRootDirectoryObject();
        IntPtr FindObpTypeObjectType();
    }

    public class KernelAddressFinder : IKernelAddressFinder
    {
        private readonly IDeviceController _deviceController;
        private readonly ICacheManager _cacheManager;

        public KernelAddressFinder(IDeviceController deviceController, ICacheManager cacheManager)
        {
            _deviceController = deviceController;
            _cacheManager = cacheManager;

            Logger = NullLogger.Instance;
        }

        public ILogger Logger { get; set; }

        public IntPtr FindKpcr()
        {
            return _cacheManager.Get("KernelAddressFinder.FindKpcr", context =>
            {
                IntPtr kpcrAdr;
                _deviceController.Send(IoCtl.IoCtlGetKpcrAdr, out kpcrAdr);
                Logger.InfoFormat("kpcr adr: 0x{0:x}", kpcrAdr.ToInt32());
                return kpcrAdr;
            });
        }

        public IntPtr FindKdDebuggerData64()
        {
            return _cacheManager.Get("KernelAddressFinder.FindKdDebuggerData64", context =>
            {
                var kpcr = FindKpcr();
                var kdDebuggerData64 = _deviceController.ReadAsIntPtr(kpcr + 0x34) // pointer of _DBGKD_GET_VERSION64 (KdVersionBlock)
                    .ReadAsIntPtr(dbgKdGetVersion64 => dbgKdGetVersion64 + 0x20) // _DBGKD_GET_VERSION64.DebuggerDataList (pointer of pointer of KDDEBUGGER_DATA64)
                    .ReadAsIntPtr() // pointer of KDDEBUGGER_DATA64
                    .Value;
                Logger.InfoFormat("KdDebuggerData64 adr: 0x{0:x}", kdDebuggerData64.ToInt32());
                return kdDebuggerData64;
            });
        }

        public IntPtr FindIdt()
        {
            return _cacheManager.Get("KernelAddressFinder.FindIdt", context =>
            {
                var kpcr = FindKpcr();
                var idt = _deviceController.ReadAsIntPtr(kpcr + 0x38).Value;
                Logger.InfoFormat("IDT adr: 0x{0:x}", idt.ToInt32());
                return idt;
            });
        }

        public IntPtr FindGdt()
        {
            return _cacheManager.Get("KernelAddressFinder.FindGdt", context =>
            {
                var kpcr = FindKpcr();
                var gdt = _deviceController.ReadAsIntPtr(kpcr + 0x3C).Value;
                Logger.InfoFormat("GDT adr: 0x{0:x}", gdt.ToInt32());
                return gdt;
            });
        }

        public IntPtr FindPsLoadedModuleList()
        {
            return _cacheManager.Get("KernelAddressFinder.FindPsLoadedModuleList", context =>
            {
                var kdDebuggerData64 = FindKdDebuggerData64();
                var psLoadedModuleList = _deviceController.ReadAsIntPtr(kdDebuggerData64 + 0x48).Value;
                Logger.InfoFormat("PsLoadedModuleList adr: 0x{0:x}", psLoadedModuleList.ToInt32());
                return psLoadedModuleList;
            });
        }

        public IntPtr FindPsActiveProcessHead()
        {
            return _cacheManager.Get("KernelAddressFinder.FindPsActiveProcessHead", context =>
            {
                var kdDebuggerData64 = FindKdDebuggerData64();
                var psActiveProcessHead = _deviceController.ReadAsIntPtr(kdDebuggerData64 + 0x50).Value;
                Logger.InfoFormat("PsActiveProcessHead adr: 0x{0:x}", psActiveProcessHead.ToInt32());
                return psActiveProcessHead;
            });
        }

        public IntPtr FindPspCidTable()
        {
            return _cacheManager.Get("KernelAddressFinder.FindPspCidTable", context =>
            {
                var kdDebuggerData64 = FindKdDebuggerData64();
                var pspCidTable = _deviceController.ReadAsIntPtr(kdDebuggerData64 + 0x58).Value;
                Logger.InfoFormat("PspCidTable adr: 0x{0:x}", pspCidTable.ToInt32());
                return pspCidTable;
            });
        }

        public IntPtr FindObpRootDirectoryObject()
        {
            return _cacheManager.Get("KernelAddressFinder.FindObpRootDirectoryObject", context =>
            {
                var kdDebuggerData64 = FindKdDebuggerData64();
                var obpRootDirectoryObject = _deviceController.ReadAsIntPtr(kdDebuggerData64 + 0x98).Value;
                Logger.InfoFormat("ObpRootDirectoryObject adr: 0x{0:x}", obpRootDirectoryObject.ToInt32());
                return obpRootDirectoryObject;
            });
        }

        public IntPtr FindObpTypeObjectType()
        {
            return _cacheManager.Get("KernelAddressFinder.FindObpTypeObjectType", context =>
            {
                var kdDebuggerData64 = FindKdDebuggerData64();
                var obpTypeObjectType = _deviceController.ReadAsIntPtr(kdDebuggerData64 + 0xa0).Value;
                Logger.InfoFormat("ObpTypeObjectType adr: 0x{0:x}", obpTypeObjectType.ToInt32());
                return obpTypeObjectType;
            });
        }
    }
}

/*

 * typedef struct _DBGKD_DEBUG_DATA_HEADER64 {

    //
    // Link to other blocks
    //

	+16
    LIST_ENTRY64 List;

    //
    // This is a unique tag to identify the owner of the block.
    // If your component only uses one pool tag, use it for this, too.
    //

	+20
    ULONG           OwnerTag;

    //
    // This must be initialized to the size of the data block,
    // including this structure.
    //

	+24
    ULONG           Size;

} DBGKD_DEBUG_DATA_HEADER64, *PDBGKD_DEBUG_DATA_HEADER64;


//
// This structure is the same size on all systems.  The only field
// which must be translated by the debugger is Header.List.
//

//
// DO NOT ADD OR REMOVE FIELDS FROM THE MIDDLE OF THIS STRUCTURE!!!
//
// If you remove a field, replace it with an "unused" placeholder.
// Do not reuse fields until there has been enough time for old debuggers
// and extensions to age out.
//
typedef struct _KDDEBUGGER_DATA64 {

	+24
    DBGKD_DEBUG_DATA_HEADER64 Header;

    //
    // Base address of kernel image
    //

	+32
    ULONG64   KernBase;

    //
    // DbgBreakPointWithStatus is a function which takes an argument
    // and hits a breakpoint.  This field contains the address of the
    // breakpoint instruction.  When the debugger sees a breakpoint
    // at this address, it may retrieve the argument from the first
    // argument register, or on x86 the eax register.
    //

	+40
    ULONG64   BreakpointWithStatus;       // address of breakpoint

    //
    // Address of the saved context record during a bugcheck
    //
    // N.B. This is an automatic in KeBugcheckEx's frame, and
    // is only valid after a bugcheck.
    //

	+48
    ULONG64   SavedContext;

    //
    // help for walking stacks with user callbacks:
    //

    //
    // The address of the thread structure is provided in the
    // WAIT_STATE_CHANGE packet.  This is the offset from the base of
    // the thread structure to the pointer to the kernel stack frame
    // for the currently active usermode callback.
    //

	+50
    USHORT  ThCallbackStack;            // offset in thread data

    //
    // these values are offsets into that frame:
    //

	+52
    USHORT  NextCallback;               // saved pointer to next callback frame
	+54
    USHORT  FramePointer;               // saved frame pointer

    //
    // pad to a quad boundary
    //
	+56
    USHORT  PaeEnabled:1;

    //
    // Address of the kernel callout routine.
    //

	+64
    ULONG64   KiCallUserMode;             // kernel routine

    //
    // Address of the usermode entry point for callbacks.
    //

	+72
    ULONG64   KeUserCallbackDispatcher;   // address in ntdll


    //
    // Addresses of various kernel data structures and lists
    // that are of interest to the kernel debugger.
    //

	+80
    ULONG64   PsLoadedModuleList;
	+88
    ULONG64   PsActiveProcessHead;
	+96
    ULONG64   PspCidTable;

	+104
    ULONG64   ExpSystemResourcesList;
	+112
    ULONG64   ExpPagedPoolDescriptor;
	+120
    ULONG64   ExpNumberOfPagedPools;

	+128
    ULONG64   KeTimeIncrement;
	+136
    ULONG64   KeBugCheckCallbackListHead;
	+144
    ULONG64   KiBugcheckData;

	+152
    ULONG64   IopErrorLogListHead;

	+160
    ULONG64   ObpRootDirectoryObject;
	+168
    ULONG64   ObpTypeObjectType;

    ULONG64   MmSystemCacheStart;
    ULONG64   MmSystemCacheEnd;
    ULONG64   MmSystemCacheWs;

    ULONG64   MmPfnDatabase;
    ULONG64   MmSystemPtesStart;
    ULONG64   MmSystemPtesEnd;
    ULONG64   MmSubsectionBase;
    ULONG64   MmNumberOfPagingFiles;

    ULONG64   MmLowestPhysicalPage;
    ULONG64   MmHighestPhysicalPage;
    ULONG64   MmNumberOfPhysicalPages;

    ULONG64   MmMaximumNonPagedPoolInBytes;
    ULONG64   MmNonPagedSystemStart;
    ULONG64   MmNonPagedPoolStart;
    ULONG64   MmNonPagedPoolEnd;

    ULONG64   MmPagedPoolStart;
    ULONG64   MmPagedPoolEnd;
    ULONG64   MmPagedPoolInformation;
    ULONG64   MmPageSize;

    ULONG64   MmSizeOfPagedPoolInBytes;

    ULONG64   MmTotalCommitLimit;
    ULONG64   MmTotalCommittedPages;
    ULONG64   MmSharedCommit;
    ULONG64   MmDriverCommit;
    ULONG64   MmProcessCommit;
    ULONG64   MmPagedPoolCommit;
    ULONG64   MmExtendedCommit;

    ULONG64   MmZeroedPageListHead;
    ULONG64   MmFreePageListHead;
    ULONG64   MmStandbyPageListHead;
    ULONG64   MmModifiedPageListHead;
    ULONG64   MmModifiedNoWritePageListHead;
    ULONG64   MmAvailablePages;
    ULONG64   MmResidentAvailablePages;

    ULONG64   PoolTrackTable;
    ULONG64   NonPagedPoolDescriptor;

    ULONG64   MmHighestUserAddress;
    ULONG64   MmSystemRangeStart;
    ULONG64   MmUserProbeAddress;

    ULONG64   KdPrintCircularBuffer;
    ULONG64   KdPrintCircularBufferEnd;
    ULONG64   KdPrintWritePointer;
    ULONG64   KdPrintRolloverCount;

    ULONG64   MmLoadedUserImageList;

    // NT 5.1 Addition

    ULONG64   NtBuildLab;
    ULONG64   KiNormalSystemCall;

    // NT 5.0 hotfix addition

    ULONG64   KiProcessorBlock;
    ULONG64   MmUnloadedDrivers;
    ULONG64   MmLastUnloadedDriver;
    ULONG64   MmTriageActionTaken;
    ULONG64   MmSpecialPoolTag;
    ULONG64   KernelVerifier;
    ULONG64   MmVerifierData;
    ULONG64   MmAllocatedNonPagedPool;
    ULONG64   MmPeakCommitment;
    ULONG64   MmTotalCommitLimitMaximum;
    ULONG64   CmNtCSDVersion;

    // NT 5.1 Addition

    ULONG64   MmPhysicalMemoryBlock;
    ULONG64   MmSessionBase;
    ULONG64   MmSessionSize;
    ULONG64   MmSystemParentTablePage;

    // Server 2003 addition

    ULONG64   MmVirtualTranslationBase;

    USHORT    OffsetKThreadNextProcessor;
    USHORT    OffsetKThreadTeb;
    USHORT    OffsetKThreadKernelStack;
    USHORT    OffsetKThreadInitialStack;

    USHORT    OffsetKThreadApcProcess;
    USHORT    OffsetKThreadState;
    USHORT    OffsetKThreadBStore;
    USHORT    OffsetKThreadBStoreLimit;

    USHORT    SizeEProcess;
    USHORT    OffsetEprocessPeb;
    USHORT    OffsetEprocessParentCID;
    USHORT    OffsetEprocessDirectoryTableBase;

    USHORT    SizePrcb;
    USHORT    OffsetPrcbDpcRoutine;
    USHORT    OffsetPrcbCurrentThread;
    USHORT    OffsetPrcbMhz;

    USHORT    OffsetPrcbCpuType;
    USHORT    OffsetPrcbVendorString;
    USHORT    OffsetPrcbProcStateContext;
    USHORT    OffsetPrcbNumber;

    USHORT    SizeEThread;

    ULONG64   KdPrintCircularBufferPtr;
    ULONG64   KdPrintBufferSize;

    ULONG64   KeLoaderBlock;

    USHORT    SizePcr;
    USHORT    OffsetPcrSelfPcr;
    USHORT    OffsetPcrCurrentPrcb;
    USHORT    OffsetPcrContainedPrcb;

    USHORT    OffsetPcrInitialBStore;
    USHORT    OffsetPcrBStoreLimit;
    USHORT    OffsetPcrInitialStack;
    USHORT    OffsetPcrStackLimit;

    USHORT    OffsetPrcbPcrPage;
    USHORT    OffsetPrcbProcStateSpecialReg;
    USHORT    GdtR0Code;
    USHORT    GdtR0Data;

    USHORT    GdtR0Pcr;
    USHORT    GdtR3Code;
    USHORT    GdtR3Data;
    USHORT    GdtR3Teb;

    USHORT    GdtLdt;
    USHORT    GdtTss;
    USHORT    Gdt64R3CmCode;
    USHORT    Gdt64R3CmTeb;

    ULONG64   IopNumTriageDumpDataBlocks;
    ULONG64   IopTriageDumpDataBlocks;

    // Longhorn addition

    ULONG64   VfCrashDataBlock;
    ULONG64   MmBadPagesDetected;
    ULONG64   MmZeroedPageSingleBitErrorsDetected;

    // Windows 7 addition

    ULONG64   EtwpDebuggerData;
    USHORT    OffsetPrcbContext;

    // Windows 8 addition

    USHORT    OffsetPrcbMaxBreakpoints;
    USHORT    OffsetPrcbMaxWatchpoints;

    ULONG     OffsetKThreadStackLimit;
    ULONG     OffsetKThreadStackBase;
    ULONG     OffsetKThreadQueueListEntry;
    ULONG     OffsetEThreadIrpList;

    USHORT    OffsetPrcbIdleThread;
    USHORT    OffsetPrcbNormalDpcState;
    USHORT    OffsetPrcbDpcStack;
    USHORT    OffsetPrcbIsrStack;

    USHORT    SizeKDPC_STACK_FRAME;

    // Windows 8.1 Addition

    USHORT    OffsetKPriQueueThreadListHead;
    USHORT    OffsetKThreadWaitReason;

} KDDEBUGGER_DATA64, *PKDDEBUGGER_DATA64;

*/

/*
lkd> dt _kpcr -b
nt!_KPCR
   +0x000 NtTib            : _NT_TIB
      +0x000 ExceptionList    : Ptr32 
      +0x004 StackBase        : Ptr32 
      +0x008 StackLimit       : Ptr32 
      +0x00c SubSystemTib     : Ptr32 
      +0x010 FiberData        : Ptr32 
      +0x010 Version          : Uint4B
      +0x014 ArbitraryUserPointer : Ptr32 
      +0x018 Self             : Ptr32 
   +0x000 Used_ExceptionList : Ptr32 
   +0x004 Used_StackBase   : Ptr32 
   +0x008 MxCsr            : Uint4B
   +0x00c TssCopy          : Ptr32 
   +0x010 ContextSwitches  : Uint4B
   +0x014 SetMemberCopy    : Uint4B
   +0x018 Used_Self        : Ptr32 
   +0x01c SelfPcr          : Ptr32 
   +0x020 Prcb             : Ptr32 
   +0x024 Irql             : UChar
   +0x028 IRR              : Uint4B
   +0x02c IrrActive        : Uint4B
   +0x030 IDR              : Uint4B
   +0x034 KdVersionBlock   : Ptr32 
   +0x038 IDT              : Ptr32 
   +0x03c GDT              : Ptr32 
   +0x040 TSS              : Ptr32 
   +0x044 MajorVersion     : Uint2B
   +0x046 MinorVersion     : Uint2B
   +0x048 SetMember        : Uint4B
   +0x04c StallScaleFactor : Uint4B
   +0x050 SpareUnused      : UChar
   +0x051 Number           : UChar
   +0x052 Spare0           : UChar
   +0x053 SecondLevelCacheAssociativity : UChar
   +0x054 VdmAlert         : Uint4B
   +0x058 KernelReserved   : Uint4B
   +0x090 SecondLevelCacheSize : Uint4B
   +0x094 HalReserved      : Uint4B
   +0x0d4 InterruptMode    : Uint4B
   +0x0d8 Spare1           : UChar
   +0x0dc KernelReserved2  : Uint4B
   +0x120 PrcbData         : _KPRCB
      +0x000 MinorVersion     : Uint2B
      +0x002 MajorVersion     : Uint2B
      +0x004 CurrentThread    : Ptr32 
      +0x008 NextThread       : Ptr32 
      +0x00c IdleThread       : Ptr32 
      +0x010 LegacyNumber     : UChar
      +0x011 NestingLevel     : UChar
      +0x012 BuildType        : Uint2B
      +0x014 CpuType          : Char
      +0x015 CpuID            : Char
      +0x016 CpuStep          : Uint2B
      +0x016 CpuStepping      : UChar
      +0x017 CpuModel         : UChar
      +0x018 ProcessorState   : _KPROCESSOR_STATE
         +0x000 ContextFrame     : _CONTEXT
            +0x000 ContextFlags     : Uint4B
            +0x004 Dr0              : Uint4B
            +0x008 Dr1              : Uint4B
            +0x00c Dr2              : Uint4B
            +0x010 Dr3              : Uint4B
            +0x014 Dr6              : Uint4B
            +0x018 Dr7              : Uint4B
            +0x01c FloatSave        : _FLOATING_SAVE_AREA
               +0x000 ControlWord      : Uint4B
               +0x004 StatusWord       : Uint4B
               +0x008 TagWord          : Uint4B
               +0x00c ErrorOffset      : Uint4B
               +0x010 ErrorSelector    : Uint4B
               +0x014 DataOffset       : Uint4B
               +0x018 DataSelector     : Uint4B
               +0x01c RegisterArea     : UChar
               +0x06c Spare0           : Uint4B
            +0x08c SegGs            : Uint4B
            +0x090 SegFs            : Uint4B
            +0x094 SegEs            : Uint4B
            +0x098 SegDs            : Uint4B
            +0x09c Edi              : Uint4B
            +0x0a0 Esi              : Uint4B
            +0x0a4 Ebx              : Uint4B
            +0x0a8 Edx              : Uint4B
            +0x0ac Ecx              : Uint4B
            +0x0b0 Eax              : Uint4B
            +0x0b4 Ebp              : Uint4B
            +0x0b8 Eip              : Uint4B
            +0x0bc SegCs            : Uint4B
            +0x0c0 EFlags           : Uint4B
            +0x0c4 Esp              : Uint4B
            +0x0c8 SegSs            : Uint4B
            +0x0cc ExtendedRegisters : UChar
         +0x2cc SpecialRegisters : _KSPECIAL_REGISTERS
            +0x000 Cr0              : Uint4B
            +0x004 Cr2              : Uint4B
            +0x008 Cr3              : Uint4B
            +0x00c Cr4              : Uint4B
            +0x010 KernelDr0        : Uint4B
            +0x014 KernelDr1        : Uint4B
            +0x018 KernelDr2        : Uint4B
            +0x01c KernelDr3        : Uint4B
            +0x020 KernelDr6        : Uint4B
            +0x024 KernelDr7        : Uint4B
            +0x028 Gdtr             : _DESCRIPTOR
               +0x000 Pad              : Uint2B
               +0x002 Limit            : Uint2B
               +0x004 Base             : Uint4B
            +0x030 Idtr             : _DESCRIPTOR
               +0x000 Pad              : Uint2B
               +0x002 Limit            : Uint2B
               +0x004 Base             : Uint4B
            +0x038 Tr               : Uint2B
            +0x03a Ldtr             : Uint2B
            +0x03c Xcr0             : Uint8B
            +0x044 ExceptionList    : Uint4B
            +0x048 Reserved         : Uint4B
      +0x338 ParentNode       : Ptr32 
      +0x33c PriorityState    : Ptr32 
      +0x340 KernelReserved   : Uint4B
      +0x378 HalReserved      : Uint4B
      +0x3b8 CFlushSize       : Uint4B
      +0x3bc CoresPerPhysicalProcessor : UChar
      +0x3bd LogicalProcessorsPerCore : UChar
      +0x3be CpuVendor        : UChar
      +0x3bf PrcbPad0         : UChar
      +0x3c0 MHz              : Uint4B
      +0x3c4 GroupIndex       : UChar
      +0x3c5 Group            : UChar
      +0x3c6 PrcbPad05        : UChar
      +0x3c8 GroupSetMember   : Uint4B
      +0x3cc Number           : Uint4B
      +0x3d0 ClockOwner       : UChar
      +0x3d1 PendingTickFlags : UChar
      +0x3d1 PendingTick      : Pos 0, 1 Bit
      +0x3d1 PendingBackupTick : Pos 1, 1 Bit
      +0x3d2 PrcbPad10        : UChar
      +0x418 LockQueue        : _KSPIN_LOCK_QUEUE
         +0x000 Next             : Ptr32 
         +0x004 Lock             : Ptr32 
      +0x4a0 InterruptCount   : Uint4B
      +0x4a4 KernelTime       : Uint4B
      +0x4a8 UserTime         : Uint4B
      +0x4ac DpcTime          : Uint4B
      +0x4b0 DpcTimeCount     : Uint4B
      +0x4b4 InterruptTime    : Uint4B
      +0x4b8 AdjustDpcThreshold : Uint4B
      +0x4bc PageColor        : Uint4B
      +0x4c0 DebuggerSavedIRQL : UChar
      +0x4c1 NodeColor        : UChar
      +0x4c2 PrcbPad20        : UChar
      +0x4c8 NodeShiftedColor : Uint4B
      +0x4cc SecondaryColorMask : Uint4B
      +0x4d0 DpcTimeLimit     : Uint4B
      +0x4d4 PrcbPad21        : Uint4B
      +0x4e0 CcFastReadNoWait : Uint4B
      +0x4e4 CcFastReadWait   : Uint4B
      +0x4e8 CcFastReadNotPossible : Uint4B
      +0x4ec CcCopyReadNoWait : Uint4B
      +0x4f0 CcCopyReadWait   : Uint4B
      +0x4f4 CcCopyReadNoWaitMiss : Uint4B
      +0x4f8 MmSpinLockOrdering : Int4B
      +0x4fc IoReadOperationCount : Int4B
      +0x500 IoWriteOperationCount : Int4B
      +0x504 IoOtherOperationCount : Int4B
      +0x508 IoReadTransferCount : _LARGE_INTEGER
         +0x000 LowPart          : Uint4B
         +0x004 HighPart         : Int4B
         +0x000 u                : <unnamed-tag>
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Int4B
         +0x000 QuadPart         : Int8B
      +0x510 IoWriteTransferCount : _LARGE_INTEGER
         +0x000 LowPart          : Uint4B
         +0x004 HighPart         : Int4B
         +0x000 u                : <unnamed-tag>
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Int4B
         +0x000 QuadPart         : Int8B
      +0x518 IoOtherTransferCount : _LARGE_INTEGER
         +0x000 LowPart          : Uint4B
         +0x004 HighPart         : Int4B
         +0x000 u                : <unnamed-tag>
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Int4B
         +0x000 QuadPart         : Int8B
      +0x520 CcFastMdlReadNoWait : Uint4B
      +0x524 CcFastMdlReadWait : Uint4B
      +0x528 CcFastMdlReadNotPossible : Uint4B
      +0x52c CcMapDataNoWait  : Uint4B
      +0x530 CcMapDataWait    : Uint4B
      +0x534 CcPinMappedDataCount : Uint4B
      +0x538 CcPinReadNoWait  : Uint4B
      +0x53c CcPinReadWait    : Uint4B
      +0x540 CcMdlReadNoWait  : Uint4B
      +0x544 CcMdlReadWait    : Uint4B
      +0x548 CcLazyWriteHotSpots : Uint4B
      +0x54c CcLazyWriteIos   : Uint4B
      +0x550 CcLazyWritePages : Uint4B
      +0x554 CcDataFlushes    : Uint4B
      +0x558 CcDataPages      : Uint4B
      +0x55c CcLostDelayedWrites : Uint4B
      +0x560 CcFastReadResourceMiss : Uint4B
      +0x564 CcCopyReadWaitMiss : Uint4B
      +0x568 CcFastMdlReadResourceMiss : Uint4B
      +0x56c CcMapDataNoWaitMiss : Uint4B
      +0x570 CcMapDataWaitMiss : Uint4B
      +0x574 CcPinReadNoWaitMiss : Uint4B
      +0x578 CcPinReadWaitMiss : Uint4B
      +0x57c CcMdlReadNoWaitMiss : Uint4B
      +0x580 CcMdlReadWaitMiss : Uint4B
      +0x584 CcReadAheadIos   : Uint4B
      +0x588 KeAlignmentFixupCount : Uint4B
      +0x58c KeExceptionDispatchCount : Uint4B
      +0x590 KeSystemCalls    : Uint4B
      +0x594 AvailableTime    : Uint4B
      +0x598 PrcbPad22        : Uint4B
      +0x5a0 PPLookasideList  : _PP_LOOKASIDE_LIST
         +0x000 P                : Ptr32 
         +0x004 L                : Ptr32 
      +0x620 PPNxPagedLookasideList : _GENERAL_LOOKASIDE_POOL
         +0x000 ListHead         : _SLIST_HEADER
            +0x000 Alignment        : Uint8B
            +0x000 Next             : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x004 Depth            : Uint2B
            +0x006 CpuId            : Uint2B
         +0x000 SingleListHead   : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 Depth            : Uint2B
         +0x00a MaximumDepth     : Uint2B
         +0x00c TotalAllocates   : Uint4B
         +0x010 AllocateMisses   : Uint4B
         +0x010 AllocateHits     : Uint4B
         +0x014 TotalFrees       : Uint4B
         +0x018 FreeMisses       : Uint4B
         +0x018 FreeHits         : Uint4B
         +0x01c Type             : 
            NonPagedPool = 0n0
            NonPagedPoolExecute = 0n0
            PagedPool = 0n1
            NonPagedPoolMustSucceed = 0n2
            DontUseThisType = 0n3
            NonPagedPoolCacheAligned = 0n4
            PagedPoolCacheAligned = 0n5
            NonPagedPoolCacheAlignedMustS = 0n6
            MaxPoolType = 0n7
            NonPagedPoolBase = 0n0
            NonPagedPoolBaseMustSucceed = 0n2
            NonPagedPoolBaseCacheAligned = 0n4
            NonPagedPoolBaseCacheAlignedMustS = 0n6
            NonPagedPoolSession = 0n32
            PagedPoolSession = 0n33
            NonPagedPoolMustSucceedSession = 0n34
            DontUseThisTypeSession = 0n35
            NonPagedPoolCacheAlignedSession = 0n36
            PagedPoolCacheAlignedSession = 0n37
            NonPagedPoolCacheAlignedMustSSession = 0n38
            NonPagedPoolNx = 0n512
            NonPagedPoolNxCacheAligned = 0n516
            NonPagedPoolSessionNx = 0n544
         +0x020 Tag              : Uint4B
         +0x024 Size             : Uint4B
         +0x028 AllocateEx       : Ptr32 
         +0x028 Allocate         : Ptr32 
         +0x02c FreeEx           : Ptr32 
         +0x02c Free             : Ptr32 
         +0x030 ListEntry        : _LIST_ENTRY
            +0x000 Flink            : Ptr32 
            +0x004 Blink            : Ptr32 
         +0x038 LastTotalAllocates : Uint4B
         +0x03c LastAllocateMisses : Uint4B
         +0x03c LastAllocateHits : Uint4B
         +0x040 Future           : Uint4B
      +0xf20 PPNPagedLookasideList : _GENERAL_LOOKASIDE_POOL
         +0x000 ListHead         : _SLIST_HEADER
            +0x000 Alignment        : Uint8B
            +0x000 Next             : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x004 Depth            : Uint2B
            +0x006 CpuId            : Uint2B
         +0x000 SingleListHead   : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 Depth            : Uint2B
         +0x00a MaximumDepth     : Uint2B
         +0x00c TotalAllocates   : Uint4B
         +0x010 AllocateMisses   : Uint4B
         +0x010 AllocateHits     : Uint4B
         +0x014 TotalFrees       : Uint4B
         +0x018 FreeMisses       : Uint4B
         +0x018 FreeHits         : Uint4B
         +0x01c Type             : 
            NonPagedPool = 0n0
            NonPagedPoolExecute = 0n0
            PagedPool = 0n1
            NonPagedPoolMustSucceed = 0n2
            DontUseThisType = 0n3
            NonPagedPoolCacheAligned = 0n4
            PagedPoolCacheAligned = 0n5
            NonPagedPoolCacheAlignedMustS = 0n6
            MaxPoolType = 0n7
            NonPagedPoolBase = 0n0
            NonPagedPoolBaseMustSucceed = 0n2
            NonPagedPoolBaseCacheAligned = 0n4
            NonPagedPoolBaseCacheAlignedMustS = 0n6
            NonPagedPoolSession = 0n32
            PagedPoolSession = 0n33
            NonPagedPoolMustSucceedSession = 0n34
            DontUseThisTypeSession = 0n35
            NonPagedPoolCacheAlignedSession = 0n36
            PagedPoolCacheAlignedSession = 0n37
            NonPagedPoolCacheAlignedMustSSession = 0n38
            NonPagedPoolNx = 0n512
            NonPagedPoolNxCacheAligned = 0n516
            NonPagedPoolSessionNx = 0n544
         +0x020 Tag              : Uint4B
         +0x024 Size             : Uint4B
         +0x028 AllocateEx       : Ptr32 
         +0x028 Allocate         : Ptr32 
         +0x02c FreeEx           : Ptr32 
         +0x02c Free             : Ptr32 
         +0x030 ListEntry        : _LIST_ENTRY
            +0x000 Flink            : Ptr32 
            +0x004 Blink            : Ptr32 
         +0x038 LastTotalAllocates : Uint4B
         +0x03c LastAllocateMisses : Uint4B
         +0x03c LastAllocateHits : Uint4B
         +0x040 Future           : Uint4B
      +0x1820 PPPagedLookasideList : _GENERAL_LOOKASIDE_POOL
         +0x000 ListHead         : _SLIST_HEADER
            +0x000 Alignment        : Uint8B
            +0x000 Next             : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x004 Depth            : Uint2B
            +0x006 CpuId            : Uint2B
         +0x000 SingleListHead   : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 Depth            : Uint2B
         +0x00a MaximumDepth     : Uint2B
         +0x00c TotalAllocates   : Uint4B
         +0x010 AllocateMisses   : Uint4B
         +0x010 AllocateHits     : Uint4B
         +0x014 TotalFrees       : Uint4B
         +0x018 FreeMisses       : Uint4B
         +0x018 FreeHits         : Uint4B
         +0x01c Type             : 
            NonPagedPool = 0n0
            NonPagedPoolExecute = 0n0
            PagedPool = 0n1
            NonPagedPoolMustSucceed = 0n2
            DontUseThisType = 0n3
            NonPagedPoolCacheAligned = 0n4
            PagedPoolCacheAligned = 0n5
            NonPagedPoolCacheAlignedMustS = 0n6
            MaxPoolType = 0n7
            NonPagedPoolBase = 0n0
            NonPagedPoolBaseMustSucceed = 0n2
            NonPagedPoolBaseCacheAligned = 0n4
            NonPagedPoolBaseCacheAlignedMustS = 0n6
            NonPagedPoolSession = 0n32
            PagedPoolSession = 0n33
            NonPagedPoolMustSucceedSession = 0n34
            DontUseThisTypeSession = 0n35
            NonPagedPoolCacheAlignedSession = 0n36
            PagedPoolCacheAlignedSession = 0n37
            NonPagedPoolCacheAlignedMustSSession = 0n38
            NonPagedPoolNx = 0n512
            NonPagedPoolNxCacheAligned = 0n516
            NonPagedPoolSessionNx = 0n544
         +0x020 Tag              : Uint4B
         +0x024 Size             : Uint4B
         +0x028 AllocateEx       : Ptr32 
         +0x028 Allocate         : Ptr32 
         +0x02c FreeEx           : Ptr32 
         +0x02c Free             : Ptr32 
         +0x030 ListEntry        : _LIST_ENTRY
            +0x000 Flink            : Ptr32 
            +0x004 Blink            : Ptr32 
         +0x038 LastTotalAllocates : Uint4B
         +0x03c LastAllocateMisses : Uint4B
         +0x03c LastAllocateHits : Uint4B
         +0x040 Future           : Uint4B
      +0x2120 PacketBarrier    : Uint4B
      +0x2124 ReverseStall     : Int4B
      +0x2128 IpiFrame         : Ptr32 
      +0x212c PrcbPad3         : UChar
      +0x2160 CurrentPacket    : Ptr32 
      +0x216c TargetSet        : Uint4B
      +0x2170 WorkerRoutine    : Ptr32 
      +0x2174 IpiFrozen        : Uint4B
      +0x2178 PrcbPad4         : UChar
      +0x21a0 RequestSummary   : Uint4B
      +0x21a4 SignalDone       : Ptr32 
      +0x21a8 PrcbPad50        : UChar
      +0x21d0 InterruptLastCount : Uint4B
      +0x21d4 InterruptRate    : Uint4B
      +0x21d8 DeviceInterrupts : Uint4B
      +0x21dc IsrDpcStats      : Ptr32 
      +0x21e0 DpcData          : _KDPC_DATA
         +0x000 DpcList          : _KDPC_LIST
            +0x000 ListHead         : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x004 LastEntry        : Ptr32 
         +0x008 DpcLock          : Uint4B
         +0x00c DpcQueueDepth    : Int4B
         +0x010 DpcCount         : Uint4B
         +0x014 ActiveDpc        : Ptr32 
      +0x2210 DpcStack         : Ptr32 
      +0x2214 MaximumDpcQueueDepth : Int4B
      +0x2218 DpcRequestRate   : Uint4B
      +0x221c MinimumDpcRate   : Uint4B
      +0x2220 DpcLastCount     : Uint4B
      +0x2224 PrcbLock         : Uint4B
      +0x2228 DpcGate          : _KGATE
         +0x000 Header           : _DISPATCHER_HEADER
            +0x000 Type             : UChar
            +0x001 TimerControlFlags : UChar
            +0x001 Absolute         : Pos 0, 1 Bit
            +0x001 Wake             : Pos 1, 1 Bit
            +0x001 EncodedTolerableDelay : Pos 2, 6 Bits
            +0x001 QueueControlFlags : UChar
            +0x001 Abandoned        : Pos 0, 1 Bit
            +0x001 DisableIncrement : Pos 1, 1 Bit
            +0x001 Signalling       : UChar
            +0x001 Timer2Flags      : UChar
            +0x001 Timer2Inserted   : Pos 0, 1 Bit
            +0x001 Timer2Expiring   : Pos 1, 1 Bit
            +0x001 Timer2CancelPending : Pos 2, 1 Bit
            +0x001 Timer2SetPending : Pos 3, 1 Bit
            +0x001 Timer2Running    : Pos 4, 1 Bit
            +0x001 Timer2Disabled   : Pos 5, 1 Bit
            +0x001 Reserved1        : Pos 6, 2 Bits
            +0x002 ThreadControlFlags : UChar
            +0x002 CycleProfiling   : Pos 0, 1 Bit
            +0x002 CounterProfiling : Pos 1, 1 Bit
            +0x002 GroupScheduling  : Pos 2, 1 Bit
            +0x002 AffinitySet      : Pos 3, 1 Bit
            +0x002 Reserved2        : Pos 4, 4 Bits
            +0x002 Hand             : UChar
            +0x002 Reserved3        : UChar
            +0x002 Size             : UChar
            +0x003 TimerMiscFlags   : UChar
            +0x003 Index            : Pos 0, 1 Bit
            +0x003 Processor        : Pos 1, 5 Bits
            +0x003 Inserted         : Pos 6, 1 Bit
            +0x003 Expired          : Pos 7, 1 Bit
            +0x003 DebugActive      : UChar
            +0x003 DpcActive        : UChar
            +0x003 Reserved5        : UChar
            +0x000 Lock             : Int4B
            +0x000 LockNV           : Int4B
            +0x004 SignalState      : Int4B
            +0x008 WaitListHead     : _LIST_ENTRY
               +0x000 Flink            : Ptr32 
               +0x004 Blink            : Ptr32 
      +0x2238 ThreadDpcEnable  : UChar
      +0x2239 QuantumEnd       : UChar
      +0x223a DpcRoutineActive : UChar
      +0x223b IdleSchedule     : UChar
      +0x223c DpcRequestSummary : Int4B
      +0x223c DpcRequestSlot   : Int2B
      +0x223c NormalDpcState   : Int2B
      +0x223e ThreadDpcState   : Int2B
      +0x223c DpcNormalProcessingActive : Pos 0, 1 Bit
      +0x223c DpcNormalProcessingRequested : Pos 1, 1 Bit
      +0x223c DpcNormalThreadSignal : Pos 2, 1 Bit
      +0x223c DpcNormalTimerExpiration : Pos 3, 1 Bit
      +0x223c DpcNormalDpcPresent : Pos 4, 1 Bit
      +0x223c DpcNormalLocalInterrupt : Pos 5, 1 Bit
      +0x223c DpcNormalSpare   : Pos 6, 10 Bits
      +0x223c DpcThreadActive  : Pos 16, 1 Bit
      +0x223c DpcThreadRequested : Pos 17, 1 Bit
      +0x223c DpcThreadSpare   : Pos 18, 14 Bits
      +0x2240 LastTimerHand    : Uint4B
      +0x2244 LastTick         : Uint4B
      +0x2248 PeriodicCount    : Uint4B
      +0x224c PeriodicBias     : Uint4B
      +0x2250 ClockInterrupts  : Uint4B
      +0x2254 ReadyScanTick    : Uint4B
      +0x2258 GroupSchedulingOverQuota : UChar
      +0x2259 PrcbPad41        : UChar
      +0x2260 TimerTable       : _KTIMER_TABLE
         +0x000 TimerExpiry      : Ptr32 
         +0x040 TimerEntries     : _KTIMER_TABLE_ENTRY
            +0x000 Lock             : Uint4B
            +0x004 Entry            : _LIST_ENTRY
               +0x000 Flink            : Ptr32 
               +0x004 Blink            : Ptr32 
            +0x010 Time             : _ULARGE_INTEGER
               +0x000 LowPart          : Uint4B
               +0x004 HighPart         : Uint4B
               +0x000 u                : <unnamed-tag>
                  +0x000 LowPart          : Uint4B
                  +0x004 HighPart         : Uint4B
               +0x000 QuadPart         : Uint8B
      +0x3aa0 CallDpc          : _KDPC
         +0x000 TargetInfoAsUlong : Uint4B
         +0x000 Type             : UChar
         +0x001 Importance       : UChar
         +0x002 Number           : Uint2B
         +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 ProcessorHistory : Uint4B
         +0x00c DeferredRoutine  : Ptr32 
         +0x010 DeferredContext  : Ptr32 
         +0x014 SystemArgument1  : Ptr32 
         +0x018 SystemArgument2  : Ptr32 
         +0x01c DpcData          : Ptr32 
      +0x3ac0 ClockKeepAlive   : Int4B
      +0x3ac4 PrcbPad6         : UChar
      +0x3ac8 DpcWatchdogPeriod : Int4B
      +0x3acc DpcWatchdogCount : Int4B
      +0x3ad0 KeSpinLockOrdering : Int4B
      +0x3ad4 PrcbPad70        : Uint4B
      +0x3ad8 QueueIndex       : Uint4B
      +0x3adc DeferredReadyListHead : _SINGLE_LIST_ENTRY
         +0x000 Next             : Ptr32 
      +0x3ae0 ReadySummary     : Uint4B
      +0x3ae4 AffinitizedSelectionMask : Int4B
      +0x3ae8 WaitLock         : Uint4B
      +0x3aec WaitListHead     : _LIST_ENTRY
         +0x000 Flink            : Ptr32 
         +0x004 Blink            : Ptr32 
      +0x3af4 ScbOffset        : Uint4B
      +0x3af8 StartCycles      : Uint8B
      +0x3b00 GenerationTarget : Uint8B
      +0x3b08 CycleTime        : Uint8B
      +0x3b10 AffinitizedCycles : Uint8B
      +0x3b18 HighCycleTime    : Uint4B
      +0x3b1c PrcbPad71        : Uint4B
      +0x3b20 DispatcherReadyListHead : _LIST_ENTRY
         +0x000 Flink            : Ptr32 
         +0x004 Blink            : Ptr32 
      +0x3c20 ChainedInterruptList : Ptr32 
      +0x3c24 LookasideIrpFloat : Int4B
      +0x3c28 ScbQueue         : _RTL_RB_TREE
         +0x000 Root             : Ptr32 
         +0x004 Min              : Ptr32 
      +0x3c30 ScbList          : _LIST_ENTRY
         +0x000 Flink            : Ptr32 
         +0x004 Blink            : Ptr32 
      +0x3c38 MmPageFaultCount : Int4B
      +0x3c3c MmCopyOnWriteCount : Int4B
      +0x3c40 MmTransitionCount : Int4B
      +0x3c44 MmCacheTransitionCount : Int4B
      +0x3c48 MmDemandZeroCount : Int4B
      +0x3c4c MmPageReadCount  : Int4B
      +0x3c50 MmPageReadIoCount : Int4B
      +0x3c54 MmCacheReadCount : Int4B
      +0x3c58 MmCacheIoCount   : Int4B
      +0x3c5c MmDirtyPagesWriteCount : Int4B
      +0x3c60 MmDirtyWriteIoCount : Int4B
      +0x3c64 MmMappedPagesWriteCount : Int4B
      +0x3c68 MmMappedWriteIoCount : Int4B
      +0x3c6c CachedCommit     : Uint4B
      +0x3c70 CachedResidentAvailable : Uint4B
      +0x3c74 HyperPte         : Ptr32 
      +0x3c78 PrcbPad8         : UChar
      +0x3c7c VendorString     : UChar
      +0x3c89 InitialApicId    : UChar
      +0x3c8a LogicalProcessorsPerPhysicalProcessor : UChar
      +0x3c8b PrcbPad9         : UChar
      +0x3c90 FeatureBits      : Uint4B
      +0x3c98 UpdateSignature  : _LARGE_INTEGER
         +0x000 LowPart          : Uint4B
         +0x004 HighPart         : Int4B
         +0x000 u                : <unnamed-tag>
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Int4B
         +0x000 QuadPart         : Int8B
      +0x3ca0 IsrTime          : Uint8B
      +0x3ca8 PrcbPad90        : Uint4B
      +0x3cb0 PowerState       : _PROCESSOR_POWER_STATE
         +0x000 IdleStates       : Ptr32 
         +0x004 IdleAccounting   : Ptr32 
         +0x008 IdleTimeLast     : Uint8B
         +0x010 IdleTimeTotal    : Uint8B
         +0x018 IdleTimeEntry    : Uint8B
         +0x020 Reserved         : Uint8B
         +0x028 IdlePolicy       : _PROC_IDLE_POLICY
            +0x000 PromotePercent   : UChar
            +0x001 DemotePercent    : UChar
            +0x002 PromotePercentBase : UChar
            +0x003 DemotePercentBase : UChar
            +0x004 AllowScaling     : UChar
         +0x030 Synchronization  : _PPM_IDLE_SYNCHRONIZATION_STATE
            +0x000 AsLong           : Int4B
            +0x000 RefCount         : Pos 0, 24 Bits
            +0x000 State            : Pos 24, 8 Bits
         +0x038 PerfFeedback     : _PROC_FEEDBACK
            +0x000 Lock             : Uint4B
            +0x008 CyclesLast       : Uint8B
            +0x010 CyclesActive     : Uint8B
            +0x018 Counters         : Ptr32 
            +0x020 LastUpdateTime   : Uint8B
            +0x028 UnscaledTime     : Uint8B
            +0x030 UnaccountedTime  : Int8B
            +0x038 ScaledTime       : Uint8B
            +0x048 UnaccountedKernelTime : Uint8B
            +0x050 PerformanceScaledKernelTime : Uint8B
            +0x058 UserTimeLast     : Uint4B
            +0x05c KernelTimeLast   : Uint4B
            +0x060 KernelTimesIndex : UChar
         +0x0a0 Hypervisor       : 
            ProcHypervisorNone = 0n0
            ProcHypervisorPresent = 0n1
            ProcHypervisorPower = 0n2
         +0x0a4 LastSysTime      : Uint4B
         +0x0a8 WmiDispatchPtr   : Uint4B
         +0x0ac WmiInterfaceEnabled : Int4B
         +0x0b0 FFHThrottleStateInfo : _PPM_FFH_THROTTLE_STATE_INFO
            +0x000 EnableLogging    : UChar
            +0x004 MismatchCount    : Uint4B
            +0x008 Initialized      : UChar
            +0x010 LastValue        : Uint8B
            +0x018 LastLogTickCount : _LARGE_INTEGER
               +0x000 LowPart          : Uint4B
               +0x004 HighPart         : Int4B
               +0x000 u                : <unnamed-tag>
                  +0x000 LowPart          : Uint4B
                  +0x004 HighPart         : Int4B
               +0x000 QuadPart         : Int8B
         +0x0d0 PerfActionDpc    : _KDPC
            +0x000 TargetInfoAsUlong : Uint4B
            +0x000 Type             : UChar
            +0x001 Importance       : UChar
            +0x002 Number           : Uint2B
            +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x008 ProcessorHistory : Uint4B
            +0x00c DeferredRoutine  : Ptr32 
            +0x010 DeferredContext  : Ptr32 
            +0x014 SystemArgument1  : Ptr32 
            +0x018 SystemArgument2  : Ptr32 
            +0x01c DpcData          : Ptr32 
         +0x0f0 PerfActionMask   : Int4B
         +0x0f8 HvIdleCheck      : _PROC_IDLE_SNAP
            +0x000 Time             : Uint8B
            +0x008 Idle             : Uint8B
         +0x108 PerfCheck        : _PROC_PERF_SNAP
            +0x000 Time             : Uint8B
            +0x008 LastTime         : Uint8B
            +0x010 Active           : Uint8B
            +0x018 LastActive       : Uint8B
            +0x020 FrequencyScaledActive : Uint8B
            +0x028 PerformanceScaledActive : Uint8B
            +0x030 CyclesActive     : Uint8B
            +0x038 CyclesAffinitized : Uint8B
         +0x148 Domain           : Ptr32 
         +0x14c PerfConstraint   : Ptr32 
         +0x150 Concurrency      : Ptr32 
         +0x154 Load             : Ptr32 
         +0x158 PerfHistory      : Ptr32 
         +0x15c GuaranteedPerformancePercent : UChar
         +0x15d HvTargetState    : UChar
         +0x15e Parked           : UChar
         +0x15f OverUtilized     : UChar
         +0x160 LatestPerformancePercent : Uint4B
         +0x164 LatestAffinitizedPercent : Uint4B
         +0x168 ExpectedUtility  : Uint4B
         +0x16c Utility          : _PROC_PERF_UTILITY
            +0x000 Affinitized      : Uint4B
            +0x004 Performance      : Uint4B
            +0x008 Total            : Uint4B
      +0x3e40 PrcbPad91        : Uint4B
      +0x3e74 DpcWatchdogDpc   : _KDPC
         +0x000 TargetInfoAsUlong : Uint4B
         +0x000 Type             : UChar
         +0x001 Importance       : UChar
         +0x002 Number           : Uint2B
         +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 ProcessorHistory : Uint4B
         +0x00c DeferredRoutine  : Ptr32 
         +0x010 DeferredContext  : Ptr32 
         +0x014 SystemArgument1  : Ptr32 
         +0x018 SystemArgument2  : Ptr32 
         +0x01c DpcData          : Ptr32 
      +0x3e98 DpcWatchdogTimer : _KTIMER
         +0x000 Header           : _DISPATCHER_HEADER
            +0x000 Type             : UChar
            +0x001 TimerControlFlags : UChar
            +0x001 Absolute         : Pos 0, 1 Bit
            +0x001 Wake             : Pos 1, 1 Bit
            +0x001 EncodedTolerableDelay : Pos 2, 6 Bits
            +0x001 QueueControlFlags : UChar
            +0x001 Abandoned        : Pos 0, 1 Bit
            +0x001 DisableIncrement : Pos 1, 1 Bit
            +0x001 Signalling       : UChar
            +0x001 Timer2Flags      : UChar
            +0x001 Timer2Inserted   : Pos 0, 1 Bit
            +0x001 Timer2Expiring   : Pos 1, 1 Bit
            +0x001 Timer2CancelPending : Pos 2, 1 Bit
            +0x001 Timer2SetPending : Pos 3, 1 Bit
            +0x001 Timer2Running    : Pos 4, 1 Bit
            +0x001 Timer2Disabled   : Pos 5, 1 Bit
            +0x001 Reserved1        : Pos 6, 2 Bits
            +0x002 ThreadControlFlags : UChar
            +0x002 CycleProfiling   : Pos 0, 1 Bit
            +0x002 CounterProfiling : Pos 1, 1 Bit
            +0x002 GroupScheduling  : Pos 2, 1 Bit
            +0x002 AffinitySet      : Pos 3, 1 Bit
            +0x002 Reserved2        : Pos 4, 4 Bits
            +0x002 Hand             : UChar
            +0x002 Reserved3        : UChar
            +0x002 Size             : UChar
            +0x003 TimerMiscFlags   : UChar
            +0x003 Index            : Pos 0, 1 Bit
            +0x003 Processor        : Pos 1, 5 Bits
            +0x003 Inserted         : Pos 6, 1 Bit
            +0x003 Expired          : Pos 7, 1 Bit
            +0x003 DebugActive      : UChar
            +0x003 DpcActive        : UChar
            +0x003 Reserved5        : UChar
            +0x000 Lock             : Int4B
            +0x000 LockNV           : Int4B
            +0x004 SignalState      : Int4B
            +0x008 WaitListHead     : _LIST_ENTRY
               +0x000 Flink            : Ptr32 
               +0x004 Blink            : Ptr32 
         +0x010 DueTime          : _ULARGE_INTEGER
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Uint4B
            +0x000 u                : <unnamed-tag>
               +0x000 LowPart          : Uint4B
               +0x004 HighPart         : Uint4B
            +0x000 QuadPart         : Uint8B
         +0x018 TimerListEntry   : _LIST_ENTRY
            +0x000 Flink            : Ptr32 
            +0x004 Blink            : Ptr32 
         +0x020 Dpc              : Ptr32 
         +0x024 Period           : Uint4B
      +0x3ec0 HypercallPageList : _SLIST_HEADER
         +0x000 Alignment        : Uint8B
         +0x000 Next             : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x004 Depth            : Uint2B
         +0x006 CpuId            : Uint2B
      +0x3ec8 HypercallPageVirtual : Ptr32 
      +0x3ecc VirtualApicAssist : Ptr32 
      +0x3ed0 StatisticsPage   : Ptr32 
      +0x3ed4 Cache            : _CACHE_DESCRIPTOR
         +0x000 Level            : UChar
         +0x001 Associativity    : UChar
         +0x002 LineSize         : Uint2B
         +0x004 Size             : Uint4B
         +0x008 Type             : 
            CacheUnified = 0n0
            CacheInstruction = 0n1
            CacheData = 0n2
            CacheTrace = 0n3
      +0x3f10 CacheCount       : Uint4B
      +0x3f14 PackageProcessorSet : _KAFFINITY_EX
         +0x000 Count            : Uint2B
         +0x002 Size             : Uint2B
         +0x004 Reserved         : Uint4B
         +0x008 Bitmap           : Uint4B
      +0x3f20 SharedReadyQueueMask : Uint4B
      +0x3f24 SharedReadyQueue : Ptr32 
      +0x3f28 CoreProcessorSet : Uint4B
      +0x3f2c ScanSiblingMask  : Uint4B
      +0x3f30 LLCMask          : Uint4B
      +0x3f34 CacheProcessorMask : Uint4B
      +0x3f48 ScanSiblingIndex : Uint4B
      +0x3f4c WheaInfo         : Ptr32 
      +0x3f50 EtwSupport       : Ptr32 
      +0x3f58 InterruptObjectPool : _SLIST_HEADER
         +0x000 Alignment        : Uint8B
         +0x000 Next             : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x004 Depth            : Uint2B
         +0x006 CpuId            : Uint2B
      +0x3f60 SharedReadyQueueOffset : Uint4B
      +0x3f64 PrcbPad92        : Uint4B
      +0x3f6c PteBitCache      : Uint4B
      +0x3f70 PteBitOffset     : Uint4B
      +0x3f74 PrcbPad93        : Uint4B
      +0x3f78 ProcessorProfileControlArea : Ptr32 
      +0x3f7c ProfileEventIndexAddress : Ptr32 
      +0x3f80 TimerExpirationDpc : _KDPC
         +0x000 TargetInfoAsUlong : Uint4B
         +0x000 Type             : UChar
         +0x001 Importance       : UChar
         +0x002 Number           : Uint2B
         +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 ProcessorHistory : Uint4B
         +0x00c DeferredRoutine  : Ptr32 
         +0x010 DeferredContext  : Ptr32 
         +0x014 SystemArgument1  : Ptr32 
         +0x018 SystemArgument2  : Ptr32 
         +0x01c DpcData          : Ptr32 
      +0x3fa0 SynchCounters    : _SYNCH_COUNTERS
         +0x000 SpinLockAcquireCount : Uint4B
         +0x004 SpinLockContentionCount : Uint4B
         +0x008 SpinLockSpinCount : Uint4B
         +0x00c IpiSendRequestBroadcastCount : Uint4B
         +0x010 IpiSendRequestRoutineCount : Uint4B
         +0x014 IpiSendSoftwareInterruptCount : Uint4B
         +0x018 ExInitializeResourceCount : Uint4B
         +0x01c ExReInitializeResourceCount : Uint4B
         +0x020 ExDeleteResourceCount : Uint4B
         +0x024 ExecutiveResourceAcquiresCount : Uint4B
         +0x028 ExecutiveResourceContentionsCount : Uint4B
         +0x02c ExecutiveResourceReleaseExclusiveCount : Uint4B
         +0x030 ExecutiveResourceReleaseSharedCount : Uint4B
         +0x034 ExecutiveResourceConvertsCount : Uint4B
         +0x038 ExAcqResExclusiveAttempts : Uint4B
         +0x03c ExAcqResExclusiveAcquiresExclusive : Uint4B
         +0x040 ExAcqResExclusiveAcquiresExclusiveRecursive : Uint4B
         +0x044 ExAcqResExclusiveWaits : Uint4B
         +0x048 ExAcqResExclusiveNotAcquires : Uint4B
         +0x04c ExAcqResSharedAttempts : Uint4B
         +0x050 ExAcqResSharedAcquiresExclusive : Uint4B
         +0x054 ExAcqResSharedAcquiresShared : Uint4B
         +0x058 ExAcqResSharedAcquiresSharedRecursive : Uint4B
         +0x05c ExAcqResSharedWaits : Uint4B
         +0x060 ExAcqResSharedNotAcquires : Uint4B
         +0x064 ExAcqResSharedStarveExclusiveAttempts : Uint4B
         +0x068 ExAcqResSharedStarveExclusiveAcquiresExclusive : Uint4B
         +0x06c ExAcqResSharedStarveExclusiveAcquiresShared : Uint4B
         +0x070 ExAcqResSharedStarveExclusiveAcquiresSharedRecursive : Uint4B
         +0x074 ExAcqResSharedStarveExclusiveWaits : Uint4B
         +0x078 ExAcqResSharedStarveExclusiveNotAcquires : Uint4B
         +0x07c ExAcqResSharedWaitForExclusiveAttempts : Uint4B
         +0x080 ExAcqResSharedWaitForExclusiveAcquiresExclusive : Uint4B
         +0x084 ExAcqResSharedWaitForExclusiveAcquiresShared : Uint4B
         +0x088 ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive : Uint4B
         +0x08c ExAcqResSharedWaitForExclusiveWaits : Uint4B
         +0x090 ExAcqResSharedWaitForExclusiveNotAcquires : Uint4B
         +0x094 ExSetResOwnerPointerExclusive : Uint4B
         +0x098 ExSetResOwnerPointerSharedNew : Uint4B
         +0x09c ExSetResOwnerPointerSharedOld : Uint4B
         +0x0a0 ExTryToAcqExclusiveAttempts : Uint4B
         +0x0a4 ExTryToAcqExclusiveAcquires : Uint4B
         +0x0a8 ExBoostExclusiveOwner : Uint4B
         +0x0ac ExBoostSharedOwners : Uint4B
         +0x0b0 ExEtwSynchTrackingNotificationsCount : Uint4B
         +0x0b4 ExEtwSynchTrackingNotificationsAccountedCount : Uint4B
      +0x4058 FsCounters       : _FILESYSTEM_DISK_COUNTERS
         +0x000 FsBytesRead      : Uint8B
         +0x008 FsBytesWritten   : Uint8B
      +0x4068 Context          : Ptr32 
      +0x406c ContextFlagsInit : Uint4B
      +0x4070 ExtendedState    : Ptr32 
      +0x4074 EntropyTimingState : _KENTROPY_TIMING_STATE
         +0x000 EntropyCount     : Uint4B
         +0x004 Buffer           : Uint4B
         +0x104 Dpc              : _KDPC
            +0x000 TargetInfoAsUlong : Uint4B
            +0x000 Type             : UChar
            +0x001 Importance       : UChar
            +0x002 Number           : Uint2B
            +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
               +0x000 Next             : Ptr32 
            +0x008 ProcessorHistory : Uint4B
            +0x00c DeferredRoutine  : Ptr32 
            +0x010 DeferredContext  : Ptr32 
            +0x014 SystemArgument1  : Ptr32 
            +0x018 SystemArgument2  : Ptr32 
            +0x01c DpcData          : Ptr32 
         +0x124 LastDeliveredBuffer : Uint4B
      +0x419c IsrStack         : Ptr32 
      +0x41a0 VectorToInterruptObject : Ptr32 
      +0x44e0 AbSelfIoBoostsList : _SINGLE_LIST_ENTRY
         +0x000 Next             : Ptr32 
      +0x44e4 AbPropagateBoostsList : _SINGLE_LIST_ENTRY
         +0x000 Next             : Ptr32 
      +0x44e8 AbDpc            : _KDPC
         +0x000 TargetInfoAsUlong : Uint4B
         +0x000 Type             : UChar
         +0x001 Importance       : UChar
         +0x002 Number           : Uint2B
         +0x004 DpcListEntry     : _SINGLE_LIST_ENTRY
            +0x000 Next             : Ptr32 
         +0x008 ProcessorHistory : Uint4B
         +0x00c DeferredRoutine  : Ptr32 
         +0x010 DeferredContext  : Ptr32 
         +0x014 SystemArgument1  : Ptr32 
         +0x018 SystemArgument2  : Ptr32 
         +0x01c DpcData          : Ptr32 
      +0x4508 TimerExpirationTrace : _KTIMER_EXPIRATION_TRACE
         +0x000 InterruptTime    : Uint8B
         +0x008 PerformanceCounter : _LARGE_INTEGER
            +0x000 LowPart          : Uint4B
            +0x004 HighPart         : Int4B
            +0x000 u                : <unnamed-tag>
               +0x000 LowPart          : Uint4B
               +0x004 HighPart         : Int4B
            +0x000 QuadPart         : Int8B
      +0x4608 TimerExpirationTraceCount : Uint4B 
 */